net/http: unexpected malformed MIME header error

[hy950921]

What version of Go are you using (go version)?

$ go version
just upgraded to 1.20.8 from 1.17

Does this issue reproduce with the latest release?

we are having it in 1.20.8 but not in 1.17

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
macos locally

What did you do?

running the url test locally

What did you expect to see?

a status code 200 is returned

What did you see instead?

500 is returned and error message=net/http: HTTP/1.x transport connection broken: malformed MIME header line: (.*)A:B

FYI: (.*)A is defined as a queryparameter and B is the value here. idk why it is identified as MIME header here.

[ianlancetaylor]

Can you show us a standalone program that reproduces the problem? I don't understand the problem from your description. Thanks.

[hy950921]

@ianlancetaylor
It is an enterprise config driven routing application, I can only share more details in words here. I am upgrading the golang version from 1.17 to 1.20.8, and I am getting some errors after running our URL tests in CI/locally. The error message from the log says "net/http: HTTP/1.x transport connection broken: malformed MIME header line: (. * )foo:bar". However, in our config definition, (. * )foo is defined as the name of queryparameter and bar is defined as the value of queryparameter. I am wondering that what changed to have this issue.

[seankhliao]

we'd need to see the request it's making to determine if it's valid

[ianlancetaylor]

CC @neild

[ianlancetaylor]

This may be due to https://go.dev/cl/410714, which restricts the bytes permitted in MIME headers to those listed in RFC 7230.

[hy950921]

@ianlancetaylor Thanks, I can confirm this is the root cause for me, is there any easy fix for experiencing such issue, we used to have some characters "parentheses" that are not allowed in 1.20 but we are hoping to keep them.

[ianlancetaylor]

Unfortunately, there is no easy fix, as the change was made for security reasons. Sorry.